PT-2024-18064

Name of the Vulnerable Software and Affected Versions MSI Afterburner version 4.6.5.16370 Description The issue is related to a Kernel Memory Leak vulnerability. It can be triggered by using the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a...

PT-2024-3377 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.8-rc7 Description: The issue is related to a double-free vulnerability in the ns update nuse function, which can lead to a denial of service. When nvme identify ns fails, it frees the pointer to the struct nvm...

PT-2024-22141

Name of the Vulnerable Software and Affected Versions RSSHub versions 1.0.0-master.cbbd829 through 1.0.0-master.d8ca915 Description RSSHub is an open source RSS feed generator. When a specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS...

PT-2024-15238 · WordPress · Backup/Restore Wordpress – Backup Plugin

Name of the Vulnerable Software and Affected Versions: Backup and Restore WordPress plugin versions 1.45 and earlier Description: The issue allows unauthenticated users to access sensitive information, such as site configuration, by not protecting some log files. This poses a severe threat to...

PT-2024-2266 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.05 Description: A critical vulnerability was found in the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the arguments schedStartTime and schedEndTime leads to a stack-based buffer...

PT-2024-2047 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS versions 8.x Description: The issue is related to insufficient input validation in the Spectrum service of ArubaOS, which can be exploited by a remote attacker to cause a denial-of-service DoS using the PAPI protocol. Successful...

PT-2024-21357 · Swftools · Swftools

Name of the Vulnerable Software and Affected Versions: swftools version 0.9.2 Description: The issue is related to a segmentation violation in the compileSWFActionCode function located at swftools/lib/action/actioncompiler.c. This function is part of the swftools library, which is used for...

PT-2024-18744 · Unknown · Libsubextractor.So

Name of the Vulnerable Software and Affected Versions: libsubextractor.so versions prior to SMR Mar-2024 Release 1 Description: The issue is an out of bounds read vulnerability in the ssmis get frm function within libsubextractor.so. This allows local attackers to read out of bounds memory...

PT-2024-18750 · Samsung · Samsung Account

Name of the Vulnerable Software and Affected Versions: Samsung Account versions prior to 14.8.00.3 Description: The issue is related to the improper handling of insufficient privileges, allowing local attackers to access data. This can be exploited by attackers to gain unauthorized access to...

PT-2024-18743 · Unknown · Customfrequencymanagerservice

Name of the Vulnerable Software and Affected Versions: CustomFrequencyManagerService versions prior to SMR Mar-2024 Release 1 Description: The issue is related to an improper access control vulnerability in the CustomFrequencyManagerService. This vulnerability allows local attackers to execute...

PT-2024-2868 · Cdata +1 · Cdata Connect +1

Name of the Vulnerable Software and Affected Versions: CData Connect versions prior to 23.4.8846 Description: A path traversal vulnerability exists in the Java version of CData Connect when running using the embedded Jetty server. This could allow an unauthenticated remote attacker to gain comple...

PT-2024-18883 · Unknown · Sourcecodester Online Mobile Management Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Mobile Management Store version 1.0 Description: A vulnerability was found in the software, affecting an unknown functionality of the file "/?p=products". The manipulation of the search argument leads to cross-site...

PT-2024-12770 · Multilaser · Multilaser Re160

Name of the Vulnerable Software and Affected Versions: Multilaser RE160 firmware versions 5.07.51 pt MTL01 through 5.07.52 pt MTL01 Description: The issue allows attackers to bypass access control and gain complete access to the application by supplying a crafted cookie. This enables attackers to...

CVE-2024-27140

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended...

Authorization

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows an unauthenticated attacker to modify account data, potentially leading to account takeover. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do...

CVE-2024-1408

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edit-profile-text-box shortcode in all versions up to, and including, 4.14.4 due to...

Cross site scripting

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login-password shortcode in all versions up to, and including, 4.14.4 due to insufficient...

Cross site scripting

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 4.14.4 due to insufficient input sanitization...

PT-2024-5241 · Node.Js +1 · Node.Js +1

Name of the Vulnerable Software and Affected Versions: Node.js versions 18.x, 20.x, and 21.x Description: The issue is related to the improper handling of batch files in child process.spawn and child process.spawnSync on Windows platforms. This allows a malicious command line argument to inject...

PT-2024-2012 · Dell · Idrac8

Name of the Vulnerable Software and Affected Versions: Dell Integrated Remote Access Controller 8 iDRAC8 affected versions not specified Description: A command injection vulnerability exists in local RACADM, which is related to incorrect input validation. This issue can be exploited by a maliciou...